Paul Maher has compiled a list of online-articles and books concerning .NET and Windows Security worth reading it.

While trying to improve my machine's security by switching to a non-Admin user (also known as least-privileged user accounts or limited-user accounts), i was (am) exploring many useful resources on the web:

• The weblog of Dirk Primbs, namely it's non-admin postings - that's where the journey started (well it started at the NCC 2005 when Mario and Dirk promoted non-admin users - did you know, that nearly almost all security holes in Internet Explorer only appear/"work" if you're running your machine as admin?)
• The non-admin Wiki is a community site for PC users who want to run as non-administrator
• "The .NET Developer's Guide to Windows Security" is the complete and free of charge wiki-version of Keith Browns Book "The .NET Developer's Guide to Windows Security"
• "Developing as non-Admin with VS.NET 2003" posting by Anil John
• "How To: Secure Your Developer Workstation" at MSDN Online
• "Developing Software in Visual Studio .NET with Non-Administrative Privileges" also MSDN Online
• "MakeMeAdmin - temporary admin for your Limited User account" a command line tool, that allows you to log on as Admin while you're logged on as non-admin.
• Aaron Margosis' non-admin postings
• to be continued...

Reading Patterns & Practices Articles in the browser may not be the best solution. It's more comfortable to read them as PDF files. Microsoft has released nearly all Architecture Guides at Patterns & Practices as PDF files - but they are as wide spread as the articles themselves.

To get rid of this mess, here is a list with direct links to the PDF-Downloads:

Application Architecture for .NET: Designing Applications and Services

Smart Client Architecture and Design Guide

Guidelines for Application Integration

Application Interoperability: Microsoft .NET and J2EE

Caching Architecture Guide for .NET Framework Applications

Designing Application-Managed Authorization

Designing Data Tier Components and Passing Data Through Tiers

Exception Management Architecture Guide

Design and Implementation Guidelines for Web Clients

UNIX Application Migration Guide

.NET Data Access Architecture Guide

Web Service Facade for Legacy Applications Guide

WS-I Basic Security Profile 1.0 Sample Application: Preview release for the .NET Framework version 1.1

...and if you don't like PDF's too, just buy the books ;-)

Langsam aber sicher bin ich dabei, mein System als normaler User und nicht als Administrator laufen zu lassen.

Dabei ist mir folgende nützliche Seite untergekommen:

nonadmin

Falls es wer übersehen haben sollte ;-)

http://www.heise.de/newsticker/meldung/60629

Jerry Bryant hat in seinem Blog ein Security Resource Guide, in dem er Links zu Security Fixes und Tools zu praktisch allen Microsoft Produkten veröffentlicht.

Microsoft hat angekündigt, Details über künftige monatliche Security Updates bereits einige Tage vor deren Veröffentlichung bereitzustellen.

Bart De Smet hat eine dreiteilige FAQ zur ASP.NET Security in seinem Blog veröffentlicht.

ASP.NET Security - The FAQ - part 1

ASP.NET Security - The FAQ - part 2

Microsoft hat einige Beispielkapitel des neuen SQL Server 2005 - Buchs zur Preview als PDF-Files bereitgestellt.